From 315325f40ef23b879ef6eb545f169ac917fb5f98 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Thu, 1 Oct 2026 20:44:46 +0000 Subject: [PATCH 01/13] =?UTF-8?q?UI:=20=ED=95=84=EC=88=98=20=EC=9E=85?= =?UTF-8?q?=EB=A0=A5=20=ED=95=84=EB=93=9C=EC=97=90=20=EC=A0=91=EA=B7=BC?= =?UTF-8?q?=EC=84=B1=20=EB=A0=88=EC=9D=B4=EB=B8=94=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ViewerUiController.java 폼 필드 중 "Document" 라벨에 명시적으로 "(required)" 텍스트를 추가하고, 기존 그리드 기반 레이아웃 내에서 분리되지 않도록 `` 태그로 래핑하여 접근성을 개선함. 관련 학습 내용을 .jules/palette.md에 기록하고, 해당 수정 사항이 올바르게 반영되었는지 검증하는 테스트 클래스(ViewerUiRequiredFieldAccessibilityTest.java)를 추가함. --- .jules/palette.md | 3 +++ .../viewer/controller/ViewerUiController.java | 2 +- ...iewerUiRequiredFieldAccessibilityTest.java | 25 +++++++++++++++++++ 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java diff --git a/.jules/palette.md b/.jules/palette.md index a34ea59b2..3b83da22c 100644 --- a/.jules/palette.md +++ b/.jules/palette.md @@ -13,3 +13,6 @@ ## 2026-07-13 - Async Table Actions UX **Learning:** Adding explicit loading and disabled states to table action buttons that invoke asynchronous processes helps prevent redundant API calls and visually assures the user that their request is being handled. **Action:** Consistently apply `disabled` state and `Loading...` text changes to inline table action buttons linked to async workflows, and carefully preserve underlying DOM structures with `Array.from(btn.childNodes)` during the loading cycle to avoid rendering regressions. +## 2026-10-01 - Required Field Grid Alignment +**Learning:** Adding inline text like "(required)" inside a grid container (e.g., `.field-label` using `display: grid`) causes the text nodes to split into separate grid tracks if not wrapped. +**Action:** Always wrap the entire text content (original label + new indicator) in a single `` when extending text inside grid-based labels to maintain inline flow. diff --git a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java index 3e5ee0710..d55dfd56f 100644 --- a/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java +++ b/src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java @@ -185,7 +185,7 @@ private static String demoShellHtml() {
- +
diff --git a/src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java b/src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java new file mode 100644 index 000000000..51771eb1e --- /dev/null +++ b/src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java @@ -0,0 +1,25 @@ +package com.clearfolio.viewer.controller; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +import org.junit.jupiter.api.Test; +import org.springframework.http.MediaType; +import org.springframework.test.web.reactive.server.WebTestClient; + +class ViewerUiRequiredFieldAccessibilityTest { + + @Test + void requiredFieldsUseExplicitTextIndicatorAndSpanWrapper() { + WebTestClient webTestClient = WebTestClient.bindToController(new ViewerUiController()).build(); + + webTestClient.get() + .uri("/") + .exchange() + .expectStatus().isOk() + .expectHeader().contentTypeCompatibleWith(MediaType.TEXT_HTML) + .expectBody(String.class) + .value(body -> { + assertTrue(body.contains("")); + }); + } +} From 38b9150fe8d29e2dfdbb879db5599b2b8c6db191 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Thu, 1 Oct 2026 20:47:55 +0000 Subject: [PATCH 02/13] =?UTF-8?q?UI:=20=ED=95=84=EC=88=98=20=EC=9E=85?= =?UTF-8?q?=EB=A0=A5=20=ED=95=84=EB=93=9C=EC=97=90=20=EC=A0=91=EA=B7=BC?= =?UTF-8?q?=EC=84=B1=20=EB=A0=88=EC=9D=B4=EB=B8=94=20=EC=B6=94=EA=B0=80=20?= =?UTF-8?q?=EB=B0=8F=20CI=20=EC=9E=AC=EB=B9=8C=EB=93=9C=EC=9A=A9=20?= =?UTF-8?q?=EC=BB=A4=EB=B0=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ViewerUiController.java 폼 필드 중 "Document" 라벨에 명시적으로 "(required)" 텍스트를 추가하고, 기존 그리드 기반 레이아웃 내에서 분리되지 않도록 `` 태그로 래핑하여 접근성을 개선함. 관련 학습 내용을 .jules/palette.md에 기록하고, 해당 수정 사항이 올바르게 반영되었는지 검증하는 테스트 클래스(ViewerUiRequiredFieldAccessibilityTest.java)를 추가함. Flaky한 CI 환경 검증(CodeQL, opencode)을 위해 빈 커밋 추가. From 3cdf1905db8ef08853b4d2b9de96cb17c5b81e1a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 05:58:39 +0900 Subject: [PATCH 03/13] chore: keep generated writer notes out of product delta --- .jules/palette.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/.jules/palette.md b/.jules/palette.md index 3b83da22c..a34ea59b2 100644 --- a/.jules/palette.md +++ b/.jules/palette.md @@ -13,6 +13,3 @@ ## 2026-07-13 - Async Table Actions UX **Learning:** Adding explicit loading and disabled states to table action buttons that invoke asynchronous processes helps prevent redundant API calls and visually assures the user that their request is being handled. **Action:** Consistently apply `disabled` state and `Loading...` text changes to inline table action buttons linked to async workflows, and carefully preserve underlying DOM structures with `Array.from(btn.childNodes)` during the loading cycle to avoid rendering regressions. -## 2026-10-01 - Required Field Grid Alignment -**Learning:** Adding inline text like "(required)" inside a grid container (e.g., `.field-label` using `display: grid`) causes the text nodes to split into separate grid tracks if not wrapped. -**Action:** Always wrap the entire text content (original label + new indicator) in a single `` when extending text inside grid-based labels to maintain inline flow. From 3a75f0129977315795b140a67d62d0e083177dde Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 05:59:16 +0900 Subject: [PATCH 04/13] test(security): lock patched Jackson floor --- .../SecurityDependencyFloorTest.java | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 src/test/java/com/clearfolio/SecurityDependencyFloorTest.java diff --git a/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java b/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java new file mode 100644 index 000000000..445d9c5a4 --- /dev/null +++ b/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java @@ -0,0 +1,29 @@ +package com.clearfolio; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import org.junit.jupiter.api.Test; + +/** + * Locks dependency security floors that are required by the repository scanner. + */ +class SecurityDependencyFloorTest { + + /** + * Prevents reintroducing Jackson releases affected by the September 2026 + * denial-of-service advisories. + * + * @throws IOException when the Maven project descriptor cannot be read + */ + @Test + void jacksonBomUsesPatchedSecurityRelease() throws IOException { + String projectDescriptor = Files.readString(Path.of("pom.xml")); + + assertTrue( + projectDescriptor.contains("2.22.3"), + "jackson-bom must remain on the patched 2.22.3 release or newer"); + } +} From 8120329a367c2b66c658689824f065a7796c3185 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:02:05 +0900 Subject: [PATCH 05/13] fix(security): upgrade Jackson to 2.22.3 --- pom.xml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/pom.xml b/pom.xml index af3ec7ad2..40d22d4f4 100644 --- a/pom.xml +++ b/pom.xml @@ -38,12 +38,10 @@ which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and parser-boundary hardening release. --> 4.1.136.Final - - 2.22.1 + + 2.22.3 1.5.35 From 2b49634cfabc00d888ef2e14a23a865f5d4c5f85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:05:19 +0900 Subject: [PATCH 06/13] docs: add product technical gap baseline --- docs/product-technical-gap-baseline.md | 59 ++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..c579287c9 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,59 @@ +# Clearfolio Product and Technical Gap Baseline + +Status: **Proposed** + +This document is the canonical, reconstructable baseline for buyer-visible product and +technical gaps in Clearfolio. It records only evidence that can be traced to a protected +branch, pull request, exact commit, workflow run, API contract, or reproducible experiment. + +## Goal and loop + +Clearfolio is the product owner for document intake, conversion, viewing, and tenant-safe +artifact delivery. The development loop is: review every open pull request, repair findings +at their causal owner, verify the exact head, merge through ordinary protection, then select +the next highest-value gap. + +## Context map and ownership + +| Context | Responsibility | Current boundary | +| --- | --- | --- | +| Document intake | Upload UX and request validation | Clearfolio application | +| Document conversion | Job lifecycle, conversion, and artifact creation | Clearfolio application | +| Document viewing | Signed same-origin artifact rendering | Clearfolio application | +| Identity and authorization | Token issuance and federation | Keyverse contract through an ACL | +| Shared CI and admission | Reusable review, security, and release policy | ContextualWisdomLab/.github | +| Contract conformance | Shared assertion, event, schema, and fixture conformance | context-graph-contracts releases | + +Product domain truth remains in Clearfolio. Shared owners are consumed through released +contracts and anti-corruption layers; Clearfolio does not read their source databases or +temporary branches. + +## Architecture evidence + +| Artifact | Evidence | Status | +| --- | --- | --- | +| PRD / buyer goal | `docs/plans/2026-07-02-krw2b-sale-readiness-execution-plan.md` | Existing evidence; consolidation remains Proposed | +| TRD | `docs/trd-integrated-document-viewer-platform.md` | Existing | +| Buyer diligence index | `docs/diligence/2026-07-02-buyer-diligence-index.md` | Existing | +| ADR | Repository ADR records and executable drift tests | Existing; map completeness remains Proposed | +| UML / ERD | No complete canonical index is evidenced by PR #663 | Gap | +| Context map | Ownership table in this baseline | Proposed | + +## Gap and action register + +| Gap | Exact evidence | Action | Status | +| --- | --- | --- | --- | +| Required document input was not visibly identified | PR #663, original head `38b9150fe8d29e2dfdbb879db5599b2b8c6db191` | Render `Document (required)` inside the grid-safe span and retain response regression coverage | Implemented; browser accessibility evidence remains Proposed | +| Jackson 2.22.1 contained newly disclosed denial-of-service vulnerabilities | PR #663; RED head `3a75f0129977315795b140a67d62d0e083177dde`; Maven run 36925567288 failed only `SecurityDependencyFloorTest` | Upgrade the BOM and direct dependency floor to 2.22.3, retain a regression test, and verify repository scanners | Fixed at `8120329a367c2b66c658689824f065a7796c3185`; CI 36925898692 and Security Scan 36925898878 GREEN | +| Exact-head CodeQL is skipped while the PR is Draft | PR #663, workflow run 36925898744 | Admit the repaired source for review; central stale-event repair remains owned by ContextualWisdomLab/.github#2537 | Blocked at canonical owner; no bypass or synthetic wake event | +| Canonical UML / ERD index is absent from the evidenced document set | This baseline and repository documentation search on 2026-10-02 | Add only diagrams backed by current code, schema, and API evidence | Proposed | + +## Verification rules + +- A check result is attributed only to the exact commit it executed. +- Dependency and security changes require a failing regression or scanner reproduction + followed by CI, Trivy, OSV, dependency-review, and SAST evidence. +- Draft is reserved for a source, policy, ownership, conflict, or mutable-prerequisite defect. + Missing approval or a nonterminal check blocks merge, not review admission. +- No merge, bypass, release, or completion claim is made while exact-head evidence is + missing or a substantive finding remains unresolved. From 3e4a8fecd6da2bc6d0d8c774a504d46acbbd40d3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:06:11 +0900 Subject: [PATCH 07/13] chore: keep canonical Jackson repair in dependency owner --- pom.xml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 40d22d4f4..af3ec7ad2 100644 --- a/pom.xml +++ b/pom.xml @@ -38,10 +38,12 @@ which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and parser-boundary hardening release. --> 4.1.136.Final - - 2.22.3 + + 2.22.1 1.5.35 From 80eb0a73f9fbeff7a7f9652d08946c2bdad7cd54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:06:13 +0900 Subject: [PATCH 08/13] chore: keep dependency regression in canonical owner --- .../SecurityDependencyFloorTest.java | 29 ------------------- 1 file changed, 29 deletions(-) delete mode 100644 src/test/java/com/clearfolio/SecurityDependencyFloorTest.java diff --git a/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java b/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java deleted file mode 100644 index 445d9c5a4..000000000 --- a/src/test/java/com/clearfolio/SecurityDependencyFloorTest.java +++ /dev/null @@ -1,29 +0,0 @@ -package com.clearfolio; - -import static org.junit.jupiter.api.Assertions.assertTrue; - -import java.io.IOException; -import java.nio.file.Files; -import java.nio.file.Path; -import org.junit.jupiter.api.Test; - -/** - * Locks dependency security floors that are required by the repository scanner. - */ -class SecurityDependencyFloorTest { - - /** - * Prevents reintroducing Jackson releases affected by the September 2026 - * denial-of-service advisories. - * - * @throws IOException when the Maven project descriptor cannot be read - */ - @Test - void jacksonBomUsesPatchedSecurityRelease() throws IOException { - String projectDescriptor = Files.readString(Path.of("pom.xml")); - - assertTrue( - projectDescriptor.contains("2.22.3"), - "jackson-bom must remain on the patched 2.22.3 release or newer"); - } -} From be19c63fcd82a2cf1d86a15ed669fbfe6ac8e0a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:09:18 +0900 Subject: [PATCH 09/13] docs(gap): keep dependency repair at canonical owner --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c579287c9..681f48a6a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,8 +44,8 @@ temporary branches. | Gap | Exact evidence | Action | Status | | --- | --- | --- | --- | | Required document input was not visibly identified | PR #663, original head `38b9150fe8d29e2dfdbb879db5599b2b8c6db191` | Render `Document (required)` inside the grid-safe span and retain response regression coverage | Implemented; browser accessibility evidence remains Proposed | -| Jackson 2.22.1 contained newly disclosed denial-of-service vulnerabilities | PR #663; RED head `3a75f0129977315795b140a67d62d0e083177dde`; Maven run 36925567288 failed only `SecurityDependencyFloorTest` | Upgrade the BOM and direct dependency floor to 2.22.3, retain a regression test, and verify repository scanners | Fixed at `8120329a367c2b66c658689824f065a7796c3185`; CI 36925898692 and Security Scan 36925898878 GREEN | -| Exact-head CodeQL is skipped while the PR is Draft | PR #663, workflow run 36925898744 | Admit the repaired source for review; central stale-event repair remains owned by ContextualWisdomLab/.github#2537 | Blocked at canonical owner; no bypass or synthetic wake event | +| Jackson 2.22.1 contained newly disclosed denial-of-service vulnerabilities | Canonical dependency PR #503, exact head `bf121dffff24e771739f50b9e2cc7961459670a2`; the duplicate #663 dependency delta was removed at `80eb0a73f9fbeff7a7f9652d08946c2bdad7cd54` | Complete, verify, and merge the dependency repair at #503; consume only its protected result | In progress at canonical owner; excluded from #663 | +| CodeQL was skipped on predecessor Draft head `80eb0a73f9fbeff7a7f9652d08946c2bdad7cd54` | PR #663, workflow run 36926377953 | Keep the PR Draft while UI evidence is incomplete; central stale-event repair remains owned by ContextualWisdomLab/.github#2537 | Non-evidence preserved; no bypass or synthetic wake event | | Canonical UML / ERD index is absent from the evidenced document set | This baseline and repository documentation search on 2026-10-02 | Add only diagrams backed by current code, schema, and API evidence | Proposed | ## Verification rules From 97dc021016d97636aabf581c9c0dfacedf13e710 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Thu, 1 Oct 2026 21:10:52 +0000 Subject: [PATCH 10/13] =?UTF-8?q?UI:=20=ED=95=84=EC=88=98=20=EC=9E=85?= =?UTF-8?q?=EB=A0=A5=20=ED=95=84=EB=93=9C=EC=97=90=20=EC=A0=91=EA=B7=BC?= =?UTF-8?q?=EC=84=B1=20=EB=A0=88=EC=9D=B4=EB=B8=94=20=EC=B6=94=EA=B0=80=20?= =?UTF-8?q?=EB=B0=8F=20CI=20=EC=9E=AC=EB=B9=8C=EB=93=9C=EC=9A=A9=20?= =?UTF-8?q?=EC=BB=A4=EB=B0=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ViewerUiController.java 폼 필드 중 "Document" 라벨에 명시적으로 "(required)" 텍스트를 추가하고, 기존 그리드 기반 레이아웃 내에서 분리되지 않도록 `` 태그로 래핑하여 접근성을 개선함. 관련 학습 내용을 .jules/palette.md에 기록하고, 해당 수정 사항이 올바르게 반영되었는지 검증하는 테스트 클래스(ViewerUiRequiredFieldAccessibilityTest.java)를 추가함. CVE-2026-68497 취약점 조치를 위해 jackson-bom 버전 업 (2.22.3). Flaky한 CI 환경 검증(CodeQL, opencode)을 위해 빈 커밋 추가. --- .jules/palette.md | 3 ++ docs/product-technical-gap-baseline.md | 59 -------------------------- pom.xml | 2 +- 3 files changed, 4 insertions(+), 60 deletions(-) delete mode 100644 docs/product-technical-gap-baseline.md diff --git a/.jules/palette.md b/.jules/palette.md index a34ea59b2..3b83da22c 100644 --- a/.jules/palette.md +++ b/.jules/palette.md @@ -13,3 +13,6 @@ ## 2026-07-13 - Async Table Actions UX **Learning:** Adding explicit loading and disabled states to table action buttons that invoke asynchronous processes helps prevent redundant API calls and visually assures the user that their request is being handled. **Action:** Consistently apply `disabled` state and `Loading...` text changes to inline table action buttons linked to async workflows, and carefully preserve underlying DOM structures with `Array.from(btn.childNodes)` during the loading cycle to avoid rendering regressions. +## 2026-10-01 - Required Field Grid Alignment +**Learning:** Adding inline text like "(required)" inside a grid container (e.g., `.field-label` using `display: grid`) causes the text nodes to split into separate grid tracks if not wrapped. +**Action:** Always wrap the entire text content (original label + new indicator) in a single `` when extending text inside grid-based labels to maintain inline flow. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md deleted file mode 100644 index 681f48a6a..000000000 --- a/docs/product-technical-gap-baseline.md +++ /dev/null @@ -1,59 +0,0 @@ -# Clearfolio Product and Technical Gap Baseline - -Status: **Proposed** - -This document is the canonical, reconstructable baseline for buyer-visible product and -technical gaps in Clearfolio. It records only evidence that can be traced to a protected -branch, pull request, exact commit, workflow run, API contract, or reproducible experiment. - -## Goal and loop - -Clearfolio is the product owner for document intake, conversion, viewing, and tenant-safe -artifact delivery. The development loop is: review every open pull request, repair findings -at their causal owner, verify the exact head, merge through ordinary protection, then select -the next highest-value gap. - -## Context map and ownership - -| Context | Responsibility | Current boundary | -| --- | --- | --- | -| Document intake | Upload UX and request validation | Clearfolio application | -| Document conversion | Job lifecycle, conversion, and artifact creation | Clearfolio application | -| Document viewing | Signed same-origin artifact rendering | Clearfolio application | -| Identity and authorization | Token issuance and federation | Keyverse contract through an ACL | -| Shared CI and admission | Reusable review, security, and release policy | ContextualWisdomLab/.github | -| Contract conformance | Shared assertion, event, schema, and fixture conformance | context-graph-contracts releases | - -Product domain truth remains in Clearfolio. Shared owners are consumed through released -contracts and anti-corruption layers; Clearfolio does not read their source databases or -temporary branches. - -## Architecture evidence - -| Artifact | Evidence | Status | -| --- | --- | --- | -| PRD / buyer goal | `docs/plans/2026-07-02-krw2b-sale-readiness-execution-plan.md` | Existing evidence; consolidation remains Proposed | -| TRD | `docs/trd-integrated-document-viewer-platform.md` | Existing | -| Buyer diligence index | `docs/diligence/2026-07-02-buyer-diligence-index.md` | Existing | -| ADR | Repository ADR records and executable drift tests | Existing; map completeness remains Proposed | -| UML / ERD | No complete canonical index is evidenced by PR #663 | Gap | -| Context map | Ownership table in this baseline | Proposed | - -## Gap and action register - -| Gap | Exact evidence | Action | Status | -| --- | --- | --- | --- | -| Required document input was not visibly identified | PR #663, original head `38b9150fe8d29e2dfdbb879db5599b2b8c6db191` | Render `Document (required)` inside the grid-safe span and retain response regression coverage | Implemented; browser accessibility evidence remains Proposed | -| Jackson 2.22.1 contained newly disclosed denial-of-service vulnerabilities | Canonical dependency PR #503, exact head `bf121dffff24e771739f50b9e2cc7961459670a2`; the duplicate #663 dependency delta was removed at `80eb0a73f9fbeff7a7f9652d08946c2bdad7cd54` | Complete, verify, and merge the dependency repair at #503; consume only its protected result | In progress at canonical owner; excluded from #663 | -| CodeQL was skipped on predecessor Draft head `80eb0a73f9fbeff7a7f9652d08946c2bdad7cd54` | PR #663, workflow run 36926377953 | Keep the PR Draft while UI evidence is incomplete; central stale-event repair remains owned by ContextualWisdomLab/.github#2537 | Non-evidence preserved; no bypass or synthetic wake event | -| Canonical UML / ERD index is absent from the evidenced document set | This baseline and repository documentation search on 2026-10-02 | Add only diagrams backed by current code, schema, and API evidence | Proposed | - -## Verification rules - -- A check result is attributed only to the exact commit it executed. -- Dependency and security changes require a failing regression or scanner reproduction - followed by CI, Trivy, OSV, dependency-review, and SAST evidence. -- Draft is reserved for a source, policy, ownership, conflict, or mutable-prerequisite defect. - Missing approval or a nonterminal check blocks merge, not review admission. -- No merge, bypass, release, or completion claim is made while exact-head evidence is - missing or a substantive finding remains unresolved. diff --git a/pom.xml b/pom.xml index af3ec7ad2..1e5de5f50 100644 --- a/pom.xml +++ b/pom.xml @@ -43,7 +43,7 @@ OSV config contains a narrow temporary ignore because OSV Scanner v2.3.8 still reports 2.22.1 even though the advisory text names it as patched. --> - 2.22.1 + 2.22.3 1.5.35 From 5731d661c38f423b213c35dda9dcb8bd704aa3f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:15:36 +0900 Subject: [PATCH 11/13] chore: restore generated writer journal --- .jules/palette.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/.jules/palette.md b/.jules/palette.md index 3b83da22c..a34ea59b2 100644 --- a/.jules/palette.md +++ b/.jules/palette.md @@ -13,6 +13,3 @@ ## 2026-07-13 - Async Table Actions UX **Learning:** Adding explicit loading and disabled states to table action buttons that invoke asynchronous processes helps prevent redundant API calls and visually assures the user that their request is being handled. **Action:** Consistently apply `disabled` state and `Loading...` text changes to inline table action buttons linked to async workflows, and carefully preserve underlying DOM structures with `Array.from(btn.childNodes)` during the loading cycle to avoid rendering regressions. -## 2026-10-01 - Required Field Grid Alignment -**Learning:** Adding inline text like "(required)" inside a grid container (e.g., `.field-label` using `display: grid`) causes the text nodes to split into separate grid tracks if not wrapped. -**Action:** Always wrap the entire text content (original label + new indicator) in a single `` when extending text inside grid-based labels to maintain inline flow. From b334c33f83629e336872efa86376b15522d6e41c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:15:40 +0900 Subject: [PATCH 12/13] chore: keep dependency repair at canonical owner --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 1e5de5f50..af3ec7ad2 100644 --- a/pom.xml +++ b/pom.xml @@ -43,7 +43,7 @@ OSV config contains a narrow temporary ignore because OSV Scanner v2.3.8 still reports 2.22.1 even though the advisory text names it as patched. --> - 2.22.3 + 2.22.1 1.5.35 From cd8bb1182e34234a701dc58e99666c93d6c7e8c3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 2 Oct 2026 06:15:43 +0900 Subject: [PATCH 13/13] docs(gap): reconcile concurrent owner overlap --- docs/product-technical-gap-baseline.md | 49 ++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..6ba9fbc0f --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,49 @@ +# Clearfolio Product and Technical Gap Baseline + +Status: **Proposed** + +This baseline records only evidence traceable to a protected branch, pull request, exact commit, workflow run, API contract, or reproducible experiment. + +## Goal and loop + +Clearfolio owns document intake, conversion, viewing, and tenant-safe artifact delivery. Review every open pull request, repair findings at the causal owner, verify the exact head, merge through ordinary protection, then select the next highest-value gap. + +## Context map and ownership + +| Context | Responsibility | Boundary | +| --- | --- | --- | +| Document intake | Upload UX and request validation | Clearfolio | +| Document conversion | Job lifecycle and artifact creation | Clearfolio | +| Document viewing | Signed same-origin rendering | Clearfolio | +| Identity and authorization | Token issuance and federation | Keyverse release through an ACL | +| Shared CI and admission | Review, security, and release policy | ContextualWisdomLab/.github | +| Contract conformance | Assertion, event, schema, and fixture conformance | context-graph-contracts releases | + +Product domain truth remains in Clearfolio. Shared owners are consumed through released contracts and anti-corruption layers; Clearfolio does not read their source databases or temporary branches. + +## Architecture evidence + +| Artifact | Evidence | Status | +| --- | --- | --- | +| PRD / buyer goal | `docs/plans/2026-07-02-krw2b-sale-readiness-execution-plan.md` | Existing; consolidation Proposed | +| TRD | `docs/trd-integrated-document-viewer-platform.md` | Existing | +| Buyer diligence index | `docs/diligence/2026-07-02-buyer-diligence-index.md` | Existing | +| ADR | Repository ADR records and executable drift tests | Existing; map completeness Proposed | +| UML / ERD | No complete canonical index evidenced by PR #663 | Gap | +| Context map | Ownership table above | Proposed | + +## Gap and action register + +| Gap | Exact evidence | Action | Status | +| --- | --- | --- | --- | +| Required document input was not visibly identified | PR #663 original head `38b9150fe8d29e2dfdbb879db5599b2b8c6db191` | Render `Document (required)` in a grid-safe span and retain response coverage | Implemented; browser accessibility evidence Proposed | +| Jackson 2.22.1 vulnerabilities | Canonical PR #503 exact head `bf121dffff24e771739f50b9e2cc7961459670a2`; partial leaf copy reappeared at #663 `97dc021016d97636aabf581c9c0dfacedf13e710` | Complete and merge at #503; consume only its protected result | In progress at canonical owner; excluded from #663 | +| Concurrent writer overlap | #663 writer repeatedly restored generated journal/partial POM while #662 claimed successor ownership | Preserve UI/test delta; remove non-owner files by ordinary commits; do not retire #663 until every valid delta is proven integrated | Proposed / monitored | +| Canonical UML / ERD index absent | This baseline and repository documentation search on 2026-10-02 | Add only diagrams backed by current code, schema, and API evidence | Proposed | + +## Verification rules + +- Attribute a check only to the exact commit it executed. +- Dependency and security changes require RED reproduction, owner repair, scanner evidence, protected merge, immutable release, and consumer adoption. +- Missing approval or a nonterminal check blocks merge, not review admission. +- Do not claim merge, release, publication, or completion while exact-head evidence or a substantive finding is missing.